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DESCRIPTION 
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Currency and Float ID Tracking in an Electronic Purse 

1.1 AREA OF THE INVENTION 

The invention relates to electronic purse systems, and in 
particular it relates to the improved management of multiple 
money flows in such systems. 

1.2 DESCRIPTION AND DISADVANTAGES OF PRIOR ART 

Electronic purse systems exist in multiple implementations and 
are usually targeted at one particular group of customers. 

An example is the electronic purse system operated by the German 
^Zentraler Kreditausschuft' (ZKA) which handles the management of 
eurocheque cards, so-called ec-cards, issued for actuating 
electronic money transfers intended by the owners of ec-cards, 
the respective card holders in Germany. 

The implementations which are known can, however, usually 
accommodate only one currency at a time, or they can only accept 
payments from one user group and do not have the capability to 
differentiate between more than one user group when using only 
one system key. Examples for such a desired differentiation are, 
however, patrons as service buyers at a company cafeteria which 
is open to employees of the company but also to contractors, to 
employees of a neighbor establishment, visitors from other 
companies, or other eligible groups. 

It is important that, when the card holder comes to a service 
provider and makes a purchase, the service provider is reimbursed 
for his services from the money which the card holder has paid 
when he had loaded his electronic purse. The path this money 
takes through the system is a money flow. 



Purses known so far do not have the feature to support more than 
one money flow with one system key only. They are understood to 
work with one currency and for one user group only. 

For terminology purposes, "purse" described here is understood to 
be a money management component which is conFigured to work with 
one currency at a time. The surrounding system however can 
accept a multitude of such "purses" conFigured to different 
currencies . 

If card holders can load their purses in one place and spend it 
in another place, or if there are different card holder groups, 
then the necessity can arise that these money flows shall be kept 
separate. The purse provider is the hub who receives load 
transaction records and money from the load stations, keeps these 
money flows in a multitude of accounts, and distributes the money 
from these accounts to service providers upon receipt of a 
purchase transaction record. If there is more than one 
environment - where the term ^environment' should be understood 
for the purposes of the present invention as a synonym for user 
group - in which cards can be loaded, and/or more than one 
environment in which the money can be spent for purchases, then 
the purse provider has to keep as many accounts as there are 
environments or user groups, respectively. Each such an account 
in prior art technique is associated with the task of maintaining 
a system key. 

Money flows into an account or out from an account must be 
traceable to the respective environment in which the load and 
purchase transactions have taken place. The purse system provider 
therefore has a business interest to keep these money flows 
separate and track them separately mainly because of billing 
purposes associated with the concerned service provider (s) . 

The service providers themselves may also want to differentiate 
between different groups of buyers simply for identification 
purposes. Different prices based on a certain subsidy for the 




employees which is not granted to foreign persons may for 
instance be a reason to identify user groups separately. Other 
reasons exist dependent of the respective field of application . 

User group separation can also be accomplished - and has been in 
the past - with different system keys for each group. Such a 
differentiation by keys introduces a prohibitively involved key 
management , including a corresponding number of Secure Access 
Modules further abbreviated herein as SAMs, which are installed 
in each load and pay stations in order to perform a secure 
processing of any load and purchase transaction and which thus 
have to be present in any load stations and purchase stations 
contained in the system. 

The handling of more than one system key, however, is difficult 
as each system key has to be kept strictly secret and must be 
hidden from service persons occupied with servicing the 
transaction processes and the services necessary to operate the 
plurality of SAMs. In any case, the generation and the 
distribution of such a system key has to be kept secure. Thus, 
even checking if a system key stored in a SAM is correct is a 
task which is difficult to perform, as it is not readable there 
out of reasons of security. The more different system keys a 
purse system uses, the lesser comfortable is its management. 

1.3. OBJECTS OF THE PRESENT INVENTION 

It is thus an object of the present invention to provide a method 
in an electronic purse system which is adapted to manage a 
plurality of user groups without maintaining a respective 
plurality of system keys each associated with a respective user 
group in prior art. 

2. SUMMARY AND ADVANTAGES OF THE PRESENT INVENTION 

The method and system as claimed in the independent claims solve 
this problem. Advantageous embodiments thereof reveal from 
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respective subclaims . 

According to the basic principles of the present invention it is 
proposed that the Secure Access Modules (SAMs) of a purse 
provider need to hold only one system key and that user groups or 
environments which can be supported by the system are identified 
by a so-called float- ID tag which is advantageously added to each 
set of data involved in a load or purchase process performed by 
the user of the electronic purse system. 

As a matter of fact, this float-ID tag introduces new features 
characterizing the user group into each set of data associated 
with a load or a purchase process. Such a new feature does not 
need to be treated as strictly secret as it is necessary with the 
system key. It may still need to be adequately protected against 
fraudulent modifications. This way, an adequate means for 
managing more than one user group or environments is found which 
does not imply any involvement of the protected system key. 

As an advantage of this basic inventional approach, purses which 
have been loaded in a given environment can be used to purchase 
goods at an environment located elsewhere, as for example it is 
the case when the purse provider operates a system at company A 
and another system at company B. 

Then, a card which has been loaded with "electronic money" at 
company A (environment A) can be used to buy services at company 
B (environment B) . The money flows are continually traceable, 
from the moment the purse is loaded at place A, up to the moment 
when a purchase is made at another establishment in B, until the 
service provider in place B receives money from the account A 
which belongs to the load station in environment A. 

By aid of said tag field identifying the specific environment or 
the user group each money flow can easily traced through the 
system. The system has become essentially more flexible compared 
to prior art while having just one system key. 




According to a second aspect of the present invention a second 
tag field can be added as described above: A currency indicating 
tag. 

The system according to this additional inventional feature has 
the advantage that it accommodates multitude of purses with 
different currencies, for instance purses for Deutsche Mark or 
purses for Euro, or purses for US Dollars, etc. 

In addition, it accepts a multitude of combinations of a currency 
and a user group, for instance a purse from an own employee in 
DM, a purse from a contractor in Euro, a purse with US Dollar 
from a neighbor company, Francs from a visitor, etc. The SAMs 
always contain the same set of keys since they belong to one 
purse provider but they still accommodate a multitude of 
currencies and environments/user groups* 

In this case each electronic purse is tagged with a parameter 
pair which indicates the currency and the user group to which the 
owner belongs- These tags can be changed under control of the 
purse provider if the purse provider decides to allow this 
feature, for instance to allow a switch of the currency for a 
purse. 

3. DRAWINGS 

An embodiment of the inventional method will be examplarily 
described in more detail in conjunction with the drawings in 
which: 

Fig. 1 is a schematic sketch of a data set generated in both of 
the above cases of loading and purchasing; 

Fig. 2 is a schematic block diagram showing the control flow 
during a process according to the method of the present invention 
in which a card used in the system is loaded; and 




Fig. 3 is a schematic block diagram showing the control flow 
during a process according to the method of the present invention 
in which a purchase is undertaken with said card described in 
Fig. 2. 



4 . DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 

With general reference to the Figures and with special reference 
to Fig. 1 the basic structure of a data set 10 generated during a 
preferred embodiment of the inventional method will be described 
as follows. 

The electronic purse system is installed in a cafeteria which can 
be visited by the staff of two companies A and B concurrently, as 
well as by visitors to the companies. Staff members and visitors 
each have a chip card for use in this electronic purse system. 
The system requires only one system key which is valid for all 
three different user groups. 

The first field contained in the data set is the currency field 
12. In here an ID is stored which is unique for each of the 
currencies supported by the electronic purse system according to 
the present invention. 

The next field is the field 14 containing the float ID. In the 
exemplary embodiment three different float Ids are required for 
identifying each of the three accepted user groups mentioned 
above . 

In the next field 16 the load or purchase amount in a transaction 
is stored. Among other fields, a balance field is optional. 

Field 18 depicts the purse-ID. By that field an individual purse 
is identified by the system. It can be used for error recovery. 




Fields 20 , 22 contain date and time associated with different 
processes as purchases or load processes effectuated by a user. 

In the portion depicted by 24 other fields are provided which 
need not to be mentioned for sake of clarity. 

Next, and with additional reference to Fig. 2 a typical card 
loading process in the inventional purse system will be described 
in more detail. 

A user, assumed as a staff member of company A wants to load his 
card. To do this, he puts it into the slot of a card loading 
terminal installed in a building of company A, step 110. 

First, in analogy to prior art authentication methods, the secure 
access module (SAM) and the purse verify the correctness of the 
system key. One component calculates a message authentication 
code (MAC) using the system key, step 120. The other component 
verifies the MAC and therewith data correctness and key equality, 
step 130. If the purse key does not match the one in the SAM, 
which might be the case when the user puts in some different 
card, the card is rejected from further processing, step 140. 

Otherwise, the SAM reads the float-ID in order to know about the 
user group the user is associated with, step 150. The float ID is 
checked whether it is supported in the SAM what yields a 
decision, step 160. If the float-ID is not maintained in the 
purse system, maybe because the user is staff member of a company 
C having the same purse system with the same system key but 
without a permission to use the load terminal, the card is 
restricted from further processing as well, step 140. 

Otherwise, step 170, the SAM reads the currency indicator from 
the purse e.g., EURO, US $, or German DM. 

The SAM checks if the indicated currency of the purse is 
supported in the SAM and rejects the purse if this is not the 
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case, steps 180, 140. A purse card can only be loaded with the 
currency which is indicated in its currency field. 

Then, the flow of events where the purse is loaded is analogous 
to prior art, step 190. 

Then, in a step 200 the program residing in the SAM generates a 
transaction data set as depicted in Fig. 1. In particular, the 
fields containing the float-ID, currency and the transaction 
amount as well as the purse-ID are stored in the data set. 
Optionally accumulated data sets which include the float ID, 
currency, and the accumulated transaction amounts of more than 
one transaction can be used to account for the total money 
turnover at a service station. This saves communication 
overhead. 

Then, in a step 210 the data set is sent to the purse provider. 

Further, in step 220 the purse balance is updated, where the load 
amount is added to the amount which was present on the card 
before loading it. Then, the loading procedure has completed and 
the card is ejected to the user, step 230. 

According to the present invention, the flow of the cash can now 
be traced throughout the purse system with the help of the data 
records as mentioned above. The users can be treated separately 
according to their respective user group. 

With reference to Fig. 3 a typical purchase is described in more 
detail which is effectuated by the same user in the cafeteria 
using a respective purchase terminal of the electronic purse 
system. 

The user chooses some coffee and some cake for three colleagues 
and himself. For paying it he inserts his card into the card 
reader present at the purchase terminal, step 310. 
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Then, preferably, steps 310 to 38 0 are performed in the same way 
as described in steps 120 to 180 with reference to Fig. 2. A 
detailed description for this sequence of steps can thus be 
omitted. 

Then, in the YES-branch of step 380 the regular price for the 
purchase is input by the staff of the cafeteria and is read by 
the system from a respective input buffer, step 390 . 

Then, in a step 400, the purse currency and float ID and thus the 
user group associated with the purse holder from company A is 
evaluated by the system. It is assumed now that for staff from 
company A a price reduction of 20% relative to the regular prices 
is granted as respective subsidies from company A are given to 
its staff members. A purse with an unsupported currency or float 
ID is rejected. 

Thus, in step 410, the reduced price is calculated as 80 % of the 
regular price. 

Then, steps 420 to 450 are performed as described in steps 200 to 
230 of Fig. 2. In particular, the data set generated contains 
again the purse's float-ID and currency. 

Thus, the purchase procedure has completed and the data set 
containing the float-ID enables the purse provider to trace the 
cash flow separated in respective user groups. 

In addition, when staff of company B is granted only a price 
reduction of 10 %, the reduced price is easily calculated as the 
reduction is coupled to the float-ID and thus to the user group 
of company B. For a visitor the price reduction would be 0 %, 
i.e., the regular price would have to be paid 

It is obvious that the general concept comprised of the present 
invention can be subjected to form various modifications not 
described explicitly in the foregoing description. In particular, 



a purse provider can provide a complex purse system having in 
total a plurality of system keys, the SAMs being spread over a 
large geographic zone and having locally concentrated purses with 
a single system key and multiple float-Ids as described before. 

Further, the inventional aspects can be combined as suited and 
required by the actual requirements. For example, the same float- 
ID could be used in different purses with different system keys. 

The present invention can be realized in hardware, software, or a 
combination of hardware and software. A typical combination of 
hardware and software could be a terminal with a SAM or any other 
software running on the SAM in more or less close interaction 
with a piece of software implemented in the user's card or 
associated to it, that, when being executed, controls the SAM or 
a program stored on the card such that it carries out the methods 
described herein. The present invention can also be embedded in a 
computer program product, which comprises all the features 
enabling the implementation of the methods described in order to 
carry out the inventional method as a whole or partly. 

Computer program means or computer program in the present context 
mean any expression, in any language, code or notation, of a set 
of instructions intended to cause a system having an information 
processing capability to perform a particular function either 
directly or after either or both of the following 

a) conversion to another language, code or notation; 

b) reproduction in a different material form. 
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CLAIMS UNov.1999 

A method for operating an electronic purse system being 
provided with a system key to protect transactions and to 
verify that a Secure Access Module (SAM) and a purse card 
belong to the same system, and in order to provide a 
personal access to access stations in said system, said 
access stations in said system being arranged for loading 
and/or debiting said data carrier with an amount of money, 

the method being characterized by the step of 

maintaining a plurality of user groups being allowed to use 
said system by 

using (200, 420) a float ID (14) being characteristic for 
each user group for uniquely associating each money flow 
effectuated by a person throughout said system with the 
respective user group. 

The method according to claim 1 in which for each load or 
debit process, or for accumulated process data from previous 
load and debit processes, a data set is generated which 
comprises said float ID (14) . 

The method according to claim 1 or claim 2 in which a data 
set is generated which comprises said float ID (14) and a 
respective currency ID (12) - 

The method according to claims 1 or 2 in which the float ID 
is used to separately track the money flows associated with 
said float ID throughout the whole purse system, from the 
purse card up to the purse provider's accounting system. 



Electronic purse system arranged for performing the method 
according to one of the preceding claims. 



6. Electronic data carrier for personal use in the system and 
arranged for performing steps of the method according to 
anyone of the claims 1 to 4 . 

7. Computer program comprising code portions adapted for 
performing the steps according to the method according to 
anyone of the claims 1 to 4 when said program is loaded into 
a secure access module. 



(Drawings) 
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The present invention relates to electronic purse systems, and in 
particular it relates to the improved management of multiple 
money flows in such systems. 

According to the basic principles of the present invention it is 
proposed that the secure Access Modules (SAMs) of a purse 
provider support multiple user groups or environments in the 
system while still requiring only one system key. The user 
groups or environments are identified by a so-called float-ID tag 
(14) which is advantageously added to each set of data involved 
in a load or purchase process performed by the user of the 
electronic purse system. (Fig. 1) 
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